Hackers breached the main server hosting ProFTPD and remained undetected for three days, causing anyone who downloaded the popular open-source file transfer application during that time to be infected with a backdoor that grants unauthorized access to their systems.
The unknown attackers gained entry to ProFTPD’s main distribution server by exploiting an unpatched vulnerability in the FTP application itself, project managers said late Wednesday night. The attackers then replaced the source files for the most recent version, ProFTPD 1.3.3c, with a backdoor. The compromise affected downloads from secondary mirror sites as well.
“The backdoor introduced by the attackers allows unauthenticated users remote root access to systems which run the maliciously modified version of the ProFTPD daemon,” project managers wrote. “Users are strongly advised to check systems running the affected code for security compromises and compile/run a known good version of the code.”
It’s the latest hack attack to hit a popular open-source distribution system. On Tuesday, the Free Software Foundation said its massive repository of free software was compromised by hackers who exploited holes in Savane, a widely used software hosting application. Project managers for GNU Savannah said they couldn’t rule out the possibility that the attackers gained root access to their system.
ProFTPD is file transfer protocol software whose source code is freely available by anyone to review or modify. It runs on Linux and Unix and is used by a long roster of organizations, including Harvard Law School, Virginia Tech Computer Science Lab, and Cisco Systems’ Linksys division.
ProFTPD’s disclosure failed to address several key details, including what version of the software the site was running. If ProFTPD servers were running the most up-to-date version, that would suggest that other sites are vulnerable to the same type of attack. The advisory also failed to say how many downloads of the infected software were logged from November 28 to December 1.
By Dan Goodin in San Francisco